Nexo Operator CRD catalog

The Nexo Edge 0.2.0 chart installs the following namespaced custom resources in API group nexo.io. Every listed CRD serves and stores only v1alpha1.

:::warning Installed does not always mean supported

The chart pins Operator build 20260611.352-008260c. Six schemas are installed but that Operator does not register or reconcile them. Do not reference a schema-only kind in a production pipeline.

:::

Core orchestration

Kind	Resource / short name	Operator support	Purpose
NexoProxy	nexoproxies / nproxy	Reconciled	Binds an upstream MongoDB address, license, deployment profile, and pipeline to a generated Proxy workload.
NexoDeploymentProfile	nexodeploymentprofiles / ndp	Reconciled	Describes approved runtime images, pull behavior, resources, and step catalog.
NexoPipeline	nexopipelines / npipe	Reconciled	Orders request, response, router, and connection component references.
NexoConnectionPipeline	nexoconnectionpipelines / ncpl	Schema only	Defines connection TLS, handshake, tenant, authentication, limits, and pooling fields, but the pinned Operator does not consume it.
NexoVersionCompat	nexoversioncompats / nvc	Reconciled	Defines version-compatibility behavior.

Traffic, routing, and resilience

Kind	Resource / short name	Operator support	Purpose
NexoRouter	nexorouters / nrouter	Reconciled	Selects an upstream or route from request context.
NexoTrafficSplit	nexotrafficsplits / nts	Reconciled	Distributes traffic across configured targets.
NexoReadWriteSplit	nexoreadwritesplits / nrws	Schema only	Defines read/write routing policy, but the pinned Operator does not register or reconcile it.
NexoShadow	nexoshadows / nshadow	Reconciled	Mirrors eligible traffic to a shadow target without using its response.
NexoCache	nexocaches / ncache	Reconciled	Configures response caching behavior.
NexoConnectionPooler	nexoconnectionpoolers / ncp	Reconciled	Defines the standalone connection-pooling component.

Security and policy

Kind	Resource / short name	Operator support	Purpose
NexoFilter	nexofilters / nfilter	Reconciled	Allows or rejects traffic using configured filter rules.
NexoQueryGuard	nexoqueryguards / nqg	Schema only	Defines query/command policy, but the pinned Operator does not register or reconcile it.
NexoQuerySizeLimit	nexoquerysizelimits / nqsl	Reconciled	Enforces configured size limits.
NexoRateLimit	nexoratelimits / nrl	Reconciled	Applies request-rate policy.
NexoTenantIsolation	nexotenantisolations / nti	Reconciled	Enforces tenant-scoped access boundaries.
NexoPIIMasking	nexopiimaskings / npii	Reconciled	Masks configured sensitive fields.
NexoFieldEncryption	nexofieldencryptions / nfe	Schema only	Defines field-encryption behavior, but the pinned Operator does not register or reconcile it.
NexoRewrite	nexorewrites / nrewrite	Reconciled	Rewrites eligible request or response content.

Observability and analysis

Kind	Resource / short name	Operator support	Purpose
NexoLogger	nexologgers / nlogger	Reconciled	Configures structured traffic and decision logging.
NexoMetrics	nexometrics / nmetrics	Reconciled	Configures pipeline metrics.
NexoAudit	nexoaudits / naudit	Reconciled	Records policy and access events.
NexoIndexAdvisor	nexoindexadvisors / nia	Schema only	Defines index-advisor configuration, but the pinned Operator does not register or reconcile it.

Conformance resource

Kind	Resource / short name	Operator support	Purpose
NexoEchoUntrusted	nexoechountrusteds / none	Schema only	Conformance schema for untrusted-step behavior; not reconciled by the pinned Operator and not a production policy feature.

Inspect installed schemas

kubectl get crd -o custom-columns=NAME:.metadata.name \
  | grep '\.nexo\.io$'

kubectl get crd nexoproxies.nexo.io \
  -o jsonpath='{range .spec.versions[*]}{.name}{" served="}{.served}{" storage="}{.storage}{"\n"}{end}'

To inspect resource status:

kubectl get nexoproxies -A
kubectl describe nexoproxy <name> --namespace <namespace>

Version and schema changes

• v1alpha1 is a Preview API and is not a long-term compatibility promise.
• The current CRDs do not declare a second served version or a conversion webhook.
• CRD updates are delivered with the Nexo Edge bundle, not by independently upgrading Operator alone.
• Each CRD has helm.sh/resource-policy: keep, so Helm uninstall retains the schema and existing custom resources.
• The current Manager does not report the installed CRD set or schema fingerprint. Confirm chart and Operator compatibility explicitly.

Before a bundle upgrade:

1. Read the selected version's release notes and breaking-change page.
2. Export Nexo custom resources from every namespace.
3. Compare installed CRD schemas with the target bundle.
4. Confirm the target Operator reconciles every kind referenced by existing NexoPipeline objects; schema presence alone is insufficient.
5. Upgrade through the supported Nexo Edge workflow.
6. Verify resource conditions, observed generations, graph revisions, and Proxy readiness.

Never delete retained Nexo CRDs until a cluster administrator confirms that no Nexo installation or custom resource in the cluster still uses them.